Tobias Wrenfeld

Nix provides strong build guarantees but cannot verify that upstream code itself is trustworthy.

Nix's fixed-output derivations gate network access with cryptographic hashes.

Nix's mismatch with NVD creates three compounding sources of false positives in vulnerability scans.

Distinguish false positives from accepted risk to audit CVE exceptions properly.

Nix package metadata provides structured license data for compliant SBOMs.

Syft captures runtime packages but misses build-time dependencies Nix tracks.

Nix's deterministic builds align naturally with SPDX supply-chain transparency standards.

A tool for converting Nix's complete dependency graphs into machine-readable SBOMs.

Nix's cryptographic dependency graph turns CVE triage into database queries.